Forensic experts will examine the remains of the improvised device that partially detonated on the London underground on Friday in the hope it will provide key clues to the identity and methodology of the attacker.

An investigation into the attack at Parsons Green, led by Scotland Yard counter-terrorism command and involving MI5, will examine the construction of the device and the chemicals used to make the explosive charge. They will in turn seek to establish where the device was put together and where the materials that made it where acquired. And they will hope to get clues from the explanation for its failure to detonate.

Investigators will meanwhile scrutinise CCTV from the underground network, which they hope will help identify suspects before there is any possibility of them striking again. They aim to answer key questions including where the person or people behind the attack entered and exited the system.

The network, including the train in question, and London generally are well covered by CCTV, while buses passing the area will also have video cameras that may provide information. Sources said it is believed investigators have an image of a potential suspect but not yet a name.

Counter-terrorism investigators are looking specifically for whoever carried the device, pictured on social media as being in a bucket, onto the tube carriage, and for how it was detonated. It is believed to have been triggered remotely. Other key questions are whether the know-how to build the device was obtained from a plethora of DIY guides on the internet, or from another person.

Assistant commissioner Mark Rowley said that hundreds of detectives have been drafted into the investigation. This year they have been busier than ever.

The explosion at Parsons Green is the fifth terrorist attack to get through Britain’s defences since March 2017. Two in London and a bombing in Manchester were blamed on Islamist-motivated terrorism. A van attack in June was blamed on an extreme rightwing motivation.

The terrorism threat level is set by the Joint Terrorism Analysis Centre, which sits within MI5. In the immediate hours after the Parsons Green incident the threat remained at severe, meaning an attack was highly likely. It was last raised to its maximum level in May for several days, after the suicide bombing attack on the Manchester Arena as investigators tried to satisfy themselves there were no suspects or bomb-making materials on the loose, and thus intending and capable of attacking again.

Similarly after Parsons Green, senior counter-terrorism officials will want to gain control of any suspects and any materials related to the attack as soon as possible.

Depending on who was behind the attack, the security services may face questions about how the bomber got through.